Trojan exploiting Excel zero-day flaw

Reports have been circulating in the last couple of days about an unpatched vulnerability in Microsoft Excel, and the software giant has now confirmed the problem. The flaw allows attackers to run code on remote machines if they can entice a user into opening a malicious Excel file. Some security...

Pwn2Own 2009: Browsers and smart phones are targets

TippingPoint’s Zero Day Initiative has released the rules for this year’s CanSecWest PWN2OWN contest, which will target unpatched flaws in Web browsers and mobile devices. Among the target list this year: Microsoft’s Internet Explorer 8, Apple’s Safari, Google’s Chrome, Windows Mobile, Google...

ZDI-09-011: Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability

ZDI-09-011: Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-011 February 10, 2009 -- CVE ID: CVE-2009-0075 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Custome...

ZDI-09-012: Microsoft Internet Explorer Malformed CSS Memory Corruption

ZDI-09-012: Microsoft Internet Explorer Malformed CSS Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-012 February 10, 2009 -- CVE ID: CVE-2009-0076 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Customer...

ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability

ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-010 February 2, 2009 -- Affected Vendors: Novell -- Affected Products: Novell Netware -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have...

ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability

ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-009 January 23, 2009 -- Affected Vendors: EMC -- Affected Products: EMC AutoStart -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability

ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-007 January 21, 2009 -- CVE ID: CVE-2009-2006 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IP...

Oracle Secure Backup login.php rbtool command injection

Added: 01/20/2009 CVE: CVE-2008-5448 BID: 33177 OSVDB: 51342 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A command injection vulnerability in the Oracle Secure Backup web interface allows a remote attacker to execute arbitrary...

ZDI-09-002: Microsoft SMB NT Trans2 Request Parsing Remote Code Execution Vulnerability

ZDI-09-002: Microsoft SMB NT Trans2 Request Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-002 January 13, 2009 -- CVE ID: CVE-2008-4835 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Server 2008 Microsoft Windows Vista...

ZDI-09-001: Microsoft SMB NT Trans Request Parsing Remote Code Execution Vulnerability

ZDI-09-001: Microsoft SMB NT Trans Request Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-001 January 13, 2009 -- CVE ID: CVE-2008-4834 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP Microsoft Windows 2000 SP4 Microsoft...

ZDI-08-088: Oracle E-Business Suite Business Intelligence SQL Injection Vulnerability

ZDI-08-088: Oracle E-Business Suite Business Intelligence SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-088 December 16, 2008 -- Affected Vendors: Oracle -- Affected Products: Oracle Database Server -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

eZ Publish 3.9.0/3.9.5/3.10.1 Command Execution Exploit (admin req)

No description provided by source. / eZ Publish OS Commanding executing exploit by s4avrd0w [email protected] Versions affected 3.x tested on version 3.9.0, 3.9.5, 3.10.1 usage: ./eZPublishabuseoffunctionalityzeroday -u=username -p=password -s=EZPublishserver The options are required: -u Login of t...

ZDI-08-082: BMC PatrolAgent Version Logging Format String Vulnerability

ZDI-08-082: BMC PatrolAgent Version Logging Format String Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-082 December 8, 2008 -- Affected Vendors: BMC Software -- Affected Products: BMC Software Patrol -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability

ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-083 December 9, 2008 -- CVE ID: CVE-2008-4255 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP -- TippingPointTM IPS...

ZDI-08-081: Sun Java Web Start and Applet Multiple Sandbox Bypass Vulnerabilities

ZDI-08-081: Sun Java Web Start and Applet Multiple Sandbox Bypass Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-08-081 December 4, 2008 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoi...

ZDI-08-080: Sun Java AWT Library Sandbox Violation Vulnerability

ZDI-08-080: Sun Java AWT Library Sandbox Violation Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-080 December 4, 2008 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers...

ZDI-08-077: Trillian AIM IMG Tag Parsing Stack Overflow Vulnerability

ZDI-08-077: Trillian AIM IMG Tag Parsing Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-077 December 4, 2008 -- Affected Vendors: Cerulean Studios -- Affected Products: Cerulean Studios Trillian -- Vulnerability Details: This vulnerability allows remote attackers ...

ZDI-08-075: EMC Control Center SAN Manager Master SST_CTGTRANS Overflow Vulnerability

ZDI-08-075: EMC Control Center SAN Manager Master SSTCTGTRANS Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-075 November 20, 2008 -- Affected Vendors: EMC -- Affected Products: EMC ControlCenter SAN Manager -- Vulnerability Details: This vulnerability allows remote...

ZDI-08-076: EMC Control Center SAN Manager SST_SENDFILE Remote File Retrieval Vulnerability

ZDI-08-076: EMC Control Center SAN Manager SSTSENDFILE Remote File Retrieval Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-076 November 20, 2008 -- Affected Vendors: EMC -- Affected Products: EMC ControlCenter SAN Manager -- Vulnerability Details: This vulnerability allows remo...

Arbitrary code execution via Flash Player dynamic module unloading — Mozilla

An anonymous security researcher reported via TippingPoint's Zero Day Initiative that insufficient checks were being performed to test whether the Flash module was properly dynamically unloaded. The researcher demonstrated that a SWF file which dynamically unloads itself from an outside JavaScrip...